unattended-upgrades
A Debian and Ubuntu package that automatically installs security updates on a schedule, without requiring someone to log in and run the update manually.
What it does and does not cover by default
On most default configurations, unattended-upgrades installs security updates automatically but leaves other, non-security package updates for manual review, which keeps the automatic behavior focused specifically on closing known vulnerabilities.
The reboot problem
Some security updates, particularly kernel updates, only take full effect after a reboot. unattended-upgrades can be configured to reboot automatically at a scheduled time, but many servers leave this off, quietly running an old kernel in memory despite an updated one being installed on disk.
Frequently asked questions
Does unattended-upgrades reboot the server automatically?
Only if explicitly configured to, through the Unattended-Upgrade::Automatic-Reboot setting; by default it typically installs updates without rebooting.
Is this tool specific to one distribution?
It is a Debian and Ubuntu package specifically; other distributions have their own equivalents, such as dnf-automatic on RHEL-based systems.
How do I know if unattended-upgrades is actually running successfully?
Check /var/log/unattended-upgrades/ for its logs, which record exactly which packages were checked and updated on each run.
Want to see where your own server stands?
Run the free, read-only server check, or open the Security Lab and watch the detect, contain, recover, verify loop in action.
Get your free server checkOpen the Security Lab